CVE-2026-43319

spi: spidev: fix lock inversion between spi_lock and buf_lock

published May 8, 2026

CVSS
—
EPSS
0%
Percentile
2.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

spi: spidev: fix lock inversion between spi_lock and buf_lock

The spidev driver previously used two mutexes, spi_lock and buf_lock,

but acquired them in different orders depending on the code path:

write()/read(): buf_lock -> spi_lock

ioctl(): spi_lock -> buf_lock

This AB-BA locking pattern triggers lockdep warnings and can

cause real deadlocks:

WARNING: possible circular locking dependency detected

spidev_ioctl() -> mutex_lock(&spidev->buf_lock)

spidev_sync_write() -> mutex_lock(&spidev->spi_lock)

*** DEADLOCK ***

The issue is reproducible with a simple userspace program that

performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from

separate threads on the same spidev file descriptor.

Fix this by simplifying the locking model and removing the lock

inversion entirely. spidev_sync() no longer performs any locking,

and all callers serialize access using spi_lock.

buf_lock is removed since its functionality is fully covered by

spi_lock, eliminating the possibility of lock ordering issues.

This removes the lock inversion and prevents deadlocks without

changing userspace ABI or behaviour.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00125 · 2.0th percentile
Published
2026-05-08T13:26Z
EPSS history
Timeline
  • 08 MAY 13:26Z
    spi: spidev: fix lock inversion between spi_lock and buf_lock
    cvelistv5